A release of the browser extension NoScript 11.2.18 has been generated, designed to block unsafe and unwanted JavaScript code, as well as various types of attacks (XSS, DNS Rebinding, CSRF, Clickjacking). The new version addresses an issue caused by a change in the handling of URL file:// in the Chromium engine. This problem led to the inability to open many sites (Gmail, Facebook, etc.) after updating the extension to version 11.2.16 in new releases of browsers using the Chromium engine (Chrome, Brave, Vivaldi).
The issue was caused by the fact that in new versions of Chromium, access to the URL "file:///" was blocked by default for extensions. The problem went unnoticed as it only manifested when installing NoScript from the Chrome Store extensions directory. When installing the zip archive from GitHub via the 'Load unpacked' menu (chrome://extensions > Developer mode), the problem does not occur, as access to the URL file:/// is not blocked in developer mode. As a workaround for the issue, the option "Allow access to file URLs" in the extension settings works.
The situation was exacerbated by the fact that after placing NoScript 11.2.16 in the Chrome Web Store directory, the author attempted to retract the release, which led to the disappearance of the entire project page. Thus, for some time, users were unable to roll back to the previous version and were forced to disable the extension. Currently, the page in the Chrome Web Store has been restored, and the issue has been resolved in release 11.2.18. In the Chrome Web Store, to avoid delays in reviewing the code for the new version, it has been decided to revert to the previous state and publish release 11.2.17, which is identical to the already verified version 11.2.11.
Source: opennet.ru
